DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
How ASF code is incorporated in other software
Software developed at the ASF is made available at no cost and without warranty
Commercial products may include ASF software without entering into any form of contract with the ASF, or even notifying us
- End users may purchase these products but may have little interest or ability to apply fixes
- There is a natural nesting that happens as software dependencies propagate through applications. Addressing vulnerabilities in base level components (e.g. log4j) has a cascading impact. Unless and until all downstream systems have effectively automated build, test and deployment systems, this creates systemic risk which has nothing to do with OSS per se.
- ASF software is used in running systems in basically 2 ways:
- A distributed system includes a running ASF product (e.g. Apache web server)
- ASF software is integrated with other software to build applications. When applications created are themselves used to create other applications, nesting happens, causing the impact of a vulnerability or incompatible change at the lowest level to have a cascading impact. When a new release is made available by an ASF project, downstream users need to minimally make configuration changes and test their systems.
- They typically have to rebuild and redeploy their applications. In nested situations, this often has to happen sequentially.
How security reports are handled (https://www.apache.org/security/)
...
End of life software running in critical systems is a systemic risk not unique to open source software or the ASF.
How ASF software makes it into the supply chain
...
Software developed at the ASF is made available at no cost and without warranty
...
Commercial products may include ASF software without entering into any form of contract with the ASF, or even notifying us
- End users may purchase these products but may have little interest or ability to apply fixes
...
.
...
Notes
The content above was developed on the security-discuss@community.apache.org mailing list, and perusing the archives there from late December 2021 to early January 2022 may provide important context. Everyone is invited to participate there, but be aware that posts to that mailing list are publicly archived. Background reading used to construct this page:
...